update: roll back what the restart actually deploys

On the deployment deploy/README.md documents, source_dir and install_dir are
the same tree and the restart command rebuilds the image from it. The
Dockerfile builds from cmd/ and internal/ and .dockerignore keeps the host
binaries out, so restoring the snapshotted binaries restored bytes nothing
reads. A bad commit therefore cost two health timeouts and two image builds
and ended in ErrRollbackFailed with an instruction to copy files back by hand,
which would not have helped either.

A deployment that rebuilds from source now has to say how the source is put
back. source_rollback "git" records the commit before the update and checks it
back out before the rollback restart. It refuses a dirty tree, because the
recorded commit does not describe one and a forced checkout would delete his
work. A build-from-source config that says nothing is refused by Validate, at
startup, rather than at the one rollback that mattered.

Also in this change, all from the same review:

  - MethodPing, the one method a locked daemon answers. Preflight passed on an
    unlocked daemon and the post-restart Presence read failed on a locked one,
    so a good update read as SHE IS PROBABLY DOWN once the env key is gone.
  - A dial failure is reported apart from a read failure. The documented
    socket is under /var/lib/docker, which a non-root operator cannot
    traverse, and "she is not answering" was the wrong diagnosis.
  - Verify refuses to run as root over a tree owned by someone else. It runs
    make build and make test in place, and root-owned artifacts break his next
    ordinary make.
  - A rollback no longer reverts config_files. That undid every config edit
    since the last apply, phraser.model_path among them.
  - The verify-failure path no longer reports rolled_back for a compile error.
  - waitHealthy caps each attempt at the remaining budget, so a 90s timeout
    cannot run to 99s.
  - tail cuts on a rune boundary. Russian test names showed the seam.
  - The claim that mavend does not import internal/update is replaced with
    what is enforced: mavend constructs no Updater and nothing can call Apply.
  - snapshot_dir inside source_dir is refused. It landed in the build context.

Found in review of #69.

cmd/mavend/main.go

@@ -356,7 +356,11 @@ func run(args []string) error {
 	if locked {
 		srv.Check = func(ctx context.Context, m ipc.Method, _ json.RawMessage) error {
 			switch m {
-			case ipc.MethodAssertStepUp, ipc.MethodUnlock:
+			case ipc.MethodAssertStepUp, ipc.MethodUnlock, ipc.MethodPing:
+				// Ping is allowed for the same reason the two unlock methods
+				// are: it never reaches CoreAPI. It answers "she is up and
+				// locked", which is what mavupdate needs to tell a daemon
+				// waiting for a passkey apart from one that failed to start.
 				return nil // allowed in locked mode
 			default:
 				return errLocked
@@ -367,6 +371,7 @@ func run(args []string) error {
 	}
 
 	srv.StepUp = func(ctx context.Context) error { return passkeySess.Assert(ctx, auth.Scope{}) }
+	srv.LockedFn = dl.isLocked
 
 	// Mail ingestion (Vikunja #246): the hook stays nil unless an email block is
 	// configured and there is a llama-server to extract with, in which case

cmd/mavupdate/main.go

@@ -12,9 +12,12 @@
 // the gate that guards the tool allowlist. That is deliberate and it is the
 // reason there is no MethodApplyUpdate anywhere in internal/ipc.
 //
-// Consequently: mavend does not import internal/update, nothing runs on a timer,
-// nothing checks a release server, and no act, intent, tool or LLM output can
-// reach any of this. She cannot update herself. She can be updated, by him.
+// Consequently: mavend never constructs an update.Updater and nothing in the
+// daemon can call Apply, nothing runs on a timer, nothing checks a release
+// server, and no act, intent, tool or LLM output can reach any of this. The
+// package is linked into mavend through internal/config, which validates the
+// update block at startup; the guarantee is the absent caller, not an absent
+// import. She cannot update herself. She can be updated, by him.
 //
 //	mavupdate -config deploy/mavend.json list          # snapshots available to roll back to
 //	mavupdate -config deploy/mavend.json verify        # make build + make test, deploys nothing
@@ -158,6 +161,12 @@ func cmdRollback(ctx context.Context, u *update.Updater, id string) {
 	res, err := u.Rollback(ctx, id)
 	report(res.Steps)
 	summarize(res)
+	// The standalone rollback is what he reaches for when something is already
+	// wrong, so a failed one needs the loud paragraph more than apply does, not
+	// less.
+	if errors.Is(err, update.ErrRollbackFailed) {
+		die("\n%v\n\nSHE IS PROBABLY DOWN. The previous artifacts are in the snapshot dir; copy them\nover the install dir and restart by hand.", err)
+	}
 	if err != nil && !errors.Is(err, update.ErrRolledBack) {
 		die("\n%v", err)
 	}